The data as described in REF  is used. For each method, the layerwise characteristics are extracted. For LID and M-D all activation layers are used (as recommended in [1]} and for our methods we use every other activation layer starting at the third (i.e. six layers overall), to reduce dimensionality. For all methods, except for C&W and Deepfool on CIFAR-100, again an LR classifier works well. For C&W and Deepfool on CIFAR-100, the results could be improved by an SVM classifier, for our LayerMFS and LayerPFS methods, using a radial basis function kernel.
